From 302349c3f23efe48c08f0811c00baa66d0225609 Mon Sep 17 00:00:00 2001 From: Gab <24553253+gabrix73@users.noreply.github.com> Date: Wed, 19 Aug 2026 08:06:41 +0200 Subject: Archive external benchmark outside active FOG --- docs/FOG-CRYPTO-SUITES.md | 44 ++++++++++++++++---------------------------- 1 file changed, 16 insertions(+), 28 deletions(-) (limited to 'docs/FOG-CRYPTO-SUITES.md') diff --git a/docs/FOG-CRYPTO-SUITES.md b/docs/FOG-CRYPTO-SUITES.md index 48402c1..e9aee7f 100644 --- a/docs/FOG-CRYPTO-SUITES.md +++ b/docs/FOG-CRYPTO-SUITES.md @@ -155,10 +155,10 @@ collapse honestly to one marketing figure. | Security role | Leading result | Status after this evaluation | | --- | --- | --- | -| PKI object hash | SHA3-256 | first-host benchmark complete, still non-active | -| PKI signatures | ML-DSA-65 plus Ed25519, both mandatory over one FOG-bound input | first-host benchmark complete, still non-active | -| KEMSphinx KEM | HPQC ML-KEM-768 plus X25519 split-PRF construction in the already calculated order | first-host complete-packet benchmark complete, still non-active | -| KEMSphinx remaining primitives | evaluated Katzenpost KDF, MAC, stream, AEZ SPRP, and payload-tag integration | hold pending side-channel, AEZ, multi-host, and complete implementation review | +| PKI object hash | SHA3-256 | candidate only, no active FOG benchmark | +| PKI signatures | ML-DSA-65 plus Ed25519, both mandatory over one FOG-bound input | candidate only, no active FOG benchmark | +| KEMSphinx KEM | ML-KEM-768 plus X25519 split-PRF construction in the already calculated order | geometry candidate only, implementation and benchmark pending | +| KEMSphinx remaining primitives | exact KDF, MAC, stream, SPRP, and payload-tag integration | no FOG implementation selected | | Noise KEM | X-Wing is the leading construction to evaluate | component candidate only | | Noise profile | exact PQ entry and mutual-authentication profiles | hold, no FOG profile selected | | End-to-end handshake and ratchet | PQXDH revision 3 plus Triple Ratchet revision 4 plus ML-KEM Braid revision 1 | retained and advanced to integration and geometry review | @@ -651,9 +651,9 @@ fixed response. A second algorithm is never tried after failure. ## 16. Benchmark Contract The benchmark phase measures complete protocol operations, not primitive -microbenchmarks alone. `FOG-CRYPTO-BENCHMARKS.md` records the first-host -implementation baseline. That partial completion does not relax the remaining -hardware, operation, review, or activation requirements below. +microbenchmarks alone. FOG currently has no active cryptographic implementation +benchmark. No archived external experiment satisfies or relaxes the hardware, +operation, review, or activation requirements below. ### 16.1 Required hardware classes @@ -701,23 +701,13 @@ The benchmark harness also runs or records: Passing statistical tests is evidence, not proof of constant-time behavior. -### 16.4 First-host baseline +### 16.4 Active evidence status -The pinned Go harness in `../benchmarks/crypto/` completed the first older -x86-64 baseline for SHA3-256, composite PKI operations, candidate KEMs, and the -exact four-hop 16,150-byte KEMSphinx request/reply path. - -The full request/reply cryptographic operation measured about 8.89 ms at the -median, with about 638 KiB and 1,452 allocations per operation. Direct use of -the parameterized maintained `Unwrap` API did not enforce FOG's exact external -packet length, so the harness adds a typed FOG boundary that rejects all -non-exact paths, packets, payloads, SURBs, encrypted replies, and reply-key -blocks before cryptographic processing. - -The result retains the evaluated candidates without activating them. Raw -three-sample data, environment details, exact sizes, exclusions, and observed -timing variability are in -`../benchmarks/crypto/results/2026-08-08-x86-64-i5-6300u.md`. +No first-host or multi-host cryptographic benchmark is active. A historical +external-library experiment is archived outside the FOG project and is not an +implementation baseline, conformance result, dependency selection, or +performance claim. Benchmark work restarts only after FOG selects a reviewed +implementation boundary and records its exact dependency and license set. ## 17. Activation and Retirement @@ -767,9 +757,9 @@ The following items remain before any cryptographic profile can become active: - publish the exact FOG PKI composite-key and signature-component encoding; - produce SHA3-256 domain vectors and the full PKI signature artifact analysis; - decide the implementation and license path for ML-DSA-65; -- audit the pinned HPQC, Katzenpost, and AEZ dependency set; -- repeat complete 16,150-byte KEMSphinx packet, SURB, and persistent replay - benchmarks on current server, ARM64, and offline Composer hardware; +- select and audit the complete implementation, dependency, and license set; +- execute complete 16,150-byte KEMSphinx packet, SURB, and persistent replay + benchmarks on x86-64, current server, ARM64, and offline Composer hardware; - select or produce a reviewed exact FOG entry and mutual PQNoise profile; - complete the PQXDH, Triple Ratchet, ML-KEM Braid, FOG envelope, and storage serialization and state integration; @@ -826,8 +816,6 @@ The following items remain before any cryptographic profile can become active: - FOG wire protocol: `FOG-WIRE.md` - FOG KEMSphinx profiles: `FOG-SPHINX-PROFILES.md` - FOG messaging: `FOG-MESSAGING.md` -- FOG cryptographic benchmark baseline: `FOG-CRYPTO-BENCHMARKS.md` - These sources support the shortlist and its constraints. The exact FOG composition still requires its own vectors, tests, benchmarks, operational analysis, and independent review. -- cgit v1.2.3